Refer to PIX/ASA 7.x Easy VPN with an ASA 5500 as the Server and PIX 506E as the Client (NEM) Configuration Example for more information on a similar scenario where the PIX/ASA 7.x acts as the Easy VPN Server. Refer to PIX-to-PIX 6.x: Easy VPN (NEM) Configuration Example for more information on a similar scenario where the PIX 506 6.x acts as the Easy VPN Server. The SA is created by default without any configuration, and the other two SAs are created for the data traffic between the networks behind the PIX and the Cisco IOS router. This may be used for management purposes to connect to the PIX's outside interface from the network behind the Cisco IOS router (either via Secure Shell, Secure HTTP for PIX Device Manager, or Telnet). When the Easy VPN Remote connects to the headend, it always negotiates two IPSec SAs with the IP address of the PIX's outside interface to any address behind the VPN server. When the Easy VPN Remote connects to a headend device, there are a minimum of five security associations (SAs), including one Internet Key Exchange (IKE) and four IPSec associations. The Easy VPN Remote feature for the PIX was introduced in PIX version 6.2 and is also referred to as hardware client/EzVPN client.

This document illustrates the configuration of IPSec between the PIX Easy VPN Remote hardware client feature and Easy VPN Server feature available in later releases of Cisco IOS® Software.

Pix 501 setup